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AMENDMENTS TO THE SPECIFICATION 
Page 5, paragraph [0017], please cancel the original paragraph and substitute the 
amended paragraph as set forth below. 

[0017] Rule-based network management approaches are4s described^-fe, in the following 
description, for the purposes of explanation, numerous specific details are set forth in order to 
provide a thorough understanding of the present invention. It will be apparent, however, to one 
skilled in the art that the present invention may be practiced without these specific details. In 
other instances, well-known structures and devices are shown in block diagram form in order to 
avoid unnecessarily obscuring the present invention. 

Page 5, paragraph [0019], please cancel the original paragraph and substitute the 
amended paragraph as set forth below. 

[0019] The needs identified in the foregoing Background, and other needs and objects that 
will become apparent f-er -from the following description, are achieved in the present invention, 
which comprises, in one aspect, a method for rule-based network management, the method 
comprising the computer-implemented steps of defining and storing a set of rules in one or more 
Rule-Based Markup Language ("RBML") documents, wherein the one or more RBML 
documents include one or more tags defining one or more rule elements. The set of rules 
includes a symptom-event rule that identifies as a symptom a particular event occurring within 
the network and a problem-diagnosis rule that defines a problem within the network as a 
correlation between one or more symptoms. The method further includes collecting and storing 
symptom-related data about one or more symptoms, wherein collecting and storing the 
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symptom-related data includes monitoring the network for one or more network events identified 
in the symptom-event rule; and detecting a problem within the network, wherein detecting 

Page 9, paragraph [0027], please cancel the original paragraph and substitute the 
amended paragraph as set forth below. 

[0027] In this context, "symptom" refers to an indication of a problem, which may result 
from an event occurring or being true (e.g., a syslog link is down), or pertinent data exceeding a 
threshold. A "problem" is a certain set of symptoms that occur a prescribed number of times in a 
specified time interval. Further, the term "network management system (NMS)" refers broadly to 
any system consisting of one or more agents or other components in network devices, one or 
more network elements, servers or appliances, and/or one or more applications or other 
infrastructure hosted in a network operations center (NOC). The approaches described herein 
apply to the NMS as a whole and also are equally applicable to elements of an NMS residing 
within a network device. 

Page 14, paragraph [0045], please cancel the original paragraph and substitute the 
amended paragraph as set forth below. 

[0045] Path 224 represents processing symptoms defined in symptoms document 206 to 
determine if the symptoms represent problems as defined in problems document 208. Path 228- 
226 and path 220 represent initiating diagnostic operations through review of diagnosis 
document 210. Such diagnosis could result in initiating further data collection operations, as 
indicated by path 232. Iterative diagnosis may be performed, as represented by path 230. Path 



3 



Ser. No. 10/714,158 filed 11/13/2003 
Sinclair et al. - 5745_CPOL 18531 1 
Docket No. 50325-0811 
226 represents a final diagnostic report or a report of additional symptoms passed back to 

elements that process problems document 208. Path 222 represents applying corrective action to 

device 202. Corrective actions may include generating a log entry, generating a report, 

generating a suggested corrective action, performing a command or SNMP operation on a 

device, etc. 

Page 22, paragraph [0071], please cancel the original paragraph and substitute the 
amended paragraph as set forth below. 

[0071] Any of the RBML documents may further include a summary block 406 that includes 
document control information, recommendations and descriptions, and/or metadata defining 
what services or systems are entitled to use or execute a rule. The summary block 406 serves as a 
documentation portion of rules. In the summary block 406 , child elements that capture 
knowledge related to the implementation of a rule are defined. Document control elements such 
as author, reviewer, creation date and review date are also included to capture related 
information. 

Page 29, paragraph [0095], please cancel the original paragraph and substitute the 
amended paragraph as set forth below. 

[0095] In one embodiment, diagnosis engine 318 is implemented as an object or process that 
functions independently except for rules that are received from RBML broker 310. FIG. 6 is a 
block diagram of an example architecture and data flow for a diagnosis engine 606 . Diagnosis 
rules 604 defined in one or more diagnosis documents 210 specify evaluations that are applied 
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on variables 608 and command output 610 that are received from the collection engine. The 

command output 610 may be parsed by parsing module 602C from command- line interface 

commands captured from devices through Telnet sessions, for example. Variables 608 may be 

Simple Network Management Protocol (SNMP) Management Information Base (MIB) values, 

for example. Analysis module 602A performs evaluations that may comprise a combination of 

arithmetic, logical, and relational expressions that operate on the variables. 



Page 34, paragraph [0108], please cancel the original paragraph and substitute the 
amended paragraph as set forth below. 



[0108] The diagnosed result 614 is provided by the reporting module 602B in an XML 
document, in one embodiment. Table 6 presents an example diagnosed result. 

TABLE 6— EXAMPLE DIAGNOSED RESULT 

<rbml> 
<results> 
<name>show_ip_blah</name> 
<type>diagnosis</type> 

<evaluate_name>check_blah</evaluate_name> 
<key> 

<name>area</name> 

<value> 1 </value> 
</key> 
<key> 

<name>ls_id</name> 

<value>10.23.44.56</value> 
</key> 

<level>8</level> 

description level="i">this is all about blah.</description> 
<recommendation level="l">this is only bad when the blah is 

misconfigui'eJ.</i'ecommendation> 
<recommendation level="5">the blah is really badly done on this 

widget!</recommendation> 
<exception level="l">misconfiguicd bkih.</exception> 
<result level="l">the blah was found to be misconfigured.</result> 
<category>routing protocol blah</category> 
</results> 

<results> 
<name>show_version_blah</name> 
<type>diagnosis</type> 

<evaluate_name>check_blah</evaluate_name> 
<level>8</level> 
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description level="l">this is all about blah.</description> 
<recommendation level="l">this is only bad when the blah is 

misc(>nfi»ured.</rea>mmend;ilion> 
<recommendation level="5">the blah is really badly done on this 

widget!</recommendation> 
<exception level=" 1 ">misconfigu red blah. </exception> 
<result level="l">the blah was found to be misconfigured.</result> 
<category>security</category> 

<function> 

<name>stack_decoder</ name> 

<var>some value here</var> 

<var>another value here</var> 
</function > 



</results> 
</rbml> 
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